Ch02 NetSec6e
Ch02 NetSec6e
Security
Chapter 2
2 2/12/2022
Quotation
Amongst the tribes of Central Australia every man, woman, and child
has a secret or sacred name which is bestowed by the older men upon
him or her soon after birth, and which is known to none but the fully
initiated members of the group. This secret name is never mentioned
except upon the most solemn occasions; to utter it in the hearing of men
of another group would be a most serious breach of tribal custom.
When mentioned at all, the name is spoken only in a whisper, and not
until the most elaborate precautions have been taken that it shall be
heard by no one but members of the group. The native thinks that a
stranger knowing his secret name would have special power to work him
ill by means of magic.
6 2/12/2022
Cryptography
9 2/12/2022
Brute Force attack
• Involves trying every possible key until an intelligible
translation of the ciphertext into plaintext is obtained
• On average, half of all possible keys must be tried to
achieve success
• Unless known plaintext is provided, the analyst must
be able to recognize plaintext as plaintext
• To supplement the brute-force approach
• Some degree of knowledge about the expected plaintext
is needed
• Some means of automatically distinguishing plaintext
from garble is also needed
10 2/12/2022
11 2/12/2022
Feistel Cipher Design
Elements
Subkey generation
• The essence of a algorithm
• Larger block Key size symmetric block
sizes mean cipher is that a • Greater
greater security • Larger key size single round offers complexity in
but reduced means greater inadequate security this algorithm
encryption/decry security but may but that multiple should lead to
ption speed decrease rounds offer greater difficulty
encryption/decrypti increasing security of cryptanalysis
on speed
Block size
Number of rounds
13 2/12/2022
Data Encryption
Standard (DES)
• Most widely used encryption scheme
14 2/12/2022
DES algorithm
• Description of the algorithm:
• Plaintext is 64 bits in length
• Key is 56 bits in length
• Structure is a minor variation of the Feistel network
• There are 16 rounds of processing
• Process of decryption is essentially the same as the encryption
process
15 2/12/2022
Table 2.2
Average Time Required for Exhaustive
Key Search
16 2/12/2022
17 2/12/2022
3DES guidelines
18 2/12/2022
Advanced encryption
standard (AES)
• In 1997 NIST issued a call for proposals for a new AES:
• Should have a security strength equal to or better than 3DES
and significantly improved efficiency
• Must be a symmetric block cipher with a block length of 128
bits and support for key lengths of 128, 192, and 256 bits
• Evaluation criteria included security, computational efficiency,
memory requirements, hardware and software suitability, and
flexibility
19 2/12/2022
20 2/12/2022
21 2/12/2022
Random and
pseudorandom Numbers
• A number of network security algorithms based on
cryptography make use of random numbers
• Examples:
• Generation of keys for the RSA public-key encryption
algorithm and other public-key algorithms
• Generation of a symmetric key for use as a temporary session
key; used in a number of networking applications such as
Transport Layer Security, Wi-Fi, e-mail security, and IP security
• In a number of key distribution scenarios, such as Kerberos,
random numbers are used for handshaking to prevent replay
attacks
23 2/12/2022
unpredictability
• In applications such as reciprocal authentication and
session key generation, the requirement is not so much
that the sequence of numbers be statistically random
but that the successive members of the sequence are
unpredictable
• With “true” random sequences, each number is
statistically independent of other numbers in the
sequence and therefore unpredictable
• Care must be taken that an opponent not be able to
predict future elements of the sequence on the basis of
earlier elements
24 2/12/2022
25 2/12/2022
Algorithm design
26 2/12/2022
27 2/12/2022
Stream Cipher design
considerations
• The encryption sequence should have a large period
• The longer the period of repeat, the more difficult it will be to do
cryptanalysis
28 2/12/2022
RC4 algorithm
• A stream cipher designed in 1987 by Ron Rivest for RSA
Security
• It is a variable key-size stream cipher with byte-oriented
operations
• The algorithm is based on the use of a random permutation
• Is used in the Secure Sockets Layer/Transport Layer
Security (SSL/TLS) standards that have been defined for
communication between Web browsers and servers
• Also used in the Wired Equivalent Privacy (WEP) protocol
and the newer WiFi Protected Access (WPA) protocol that
are part of the IEEE 802.11 wireless LAN standard
29 2/12/2022
30 2/12/2022
Cipher block Modes
of Operation
• A symmetric block cipher processes one block of data at a
time
• In the case of DES and 3DES, the block length is b=64 bits
• For AES, the block length is b=128
• For longer amounts of plaintext, it is necessary to break the
plaintext into b-bit blocks, padding the last block if necessary
31 2/12/2022
Electronic
Codebook Mode (ECB)
• Plaintext is handled b bits at a time and each block of plaintext is
encrypted using the same key
• The term “codebook” is used because, for a given key, there is a
unique ciphertext for every b-bit block of plaintext
• One can imagine a gigantic codebook in which there is an entry
for every possible b-bit plaintext pattern showing its corresponding
ciphertext
• With ECB, if the same b-bit block of plaintext appears more than
once in the message, it always produces the same ciphertext
• Because of this, for lengthy messages, the ECB mode may not be
secure
• If the message is highly structured, it may be possible for a
cryptanalyst to exploit these regularities
2/12/2022 32
33 2/12/2022
34 2/12/2022
35 2/12/2022
Advantages of CTR mode
• Hardware efficiency
• Encryption/decryption can be done in parallel on multiple blocks of plaintext or ciphertext
• Throughput is only limited by the amount of parallelism that is achieved
• Software efficiency
• Because of the opportunities for parallel execution, processors that support parallel features can
be effectively utilized
• Preprocessing
• The execution of the underlying encryption algorithm does not depend on input of the plaintext
or ciphertext --- when the plaintext or ciphertext input is presented, the only computation is a
series of XORs, greatly enhancing throughput
• Random access
• The ith block of plaintext or ciphertext can be processed in random-access fashion
• Provable security
• It can be shown that CTR is at least as secure as the other modes discussed in this section
• Simplicity
• Requires only the implementation of the encryption algorithm and not the decryption algorithm
36 2/12/2022
summary
• Symmetric encryption • Random and pseudorandom
principles numbers
• Cryptography • The use of random numbers
• Cryptanalysis • TRNGs, PRNGs, PRFs
• Feistel cipher structure • Algorithm design